Security audit

Gettr Transcribe

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it needs review because unvalidated inputs can access non-GETTR resources or write outside the intended output folder.

Install only if you are comfortable running local shell scripts, ffmpeg, brew, pip, and MLX Whisper on media you select. Use only trusted GETTR-derived media URLs, keep slugs to simple letters/numbers/dashes/underscores, avoid elevated privileges, and consider pinning dependency and model versions before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Package and Runtime Model Dependencies
Content: View full analysis
&1 || { echo "[warn] Retrying without extra flags..." >&2 mlx_whisper "$AUDIO_FILE" \ -f vtt \ -o "$OUT_DIR" \ --model mlx-community/whisper-large-v3-turbo \ $LANG_FLAG } ``` Related installation instructions also use an unpinned dependency: ```bash pip install mlx-whisper ``` ### Technical Analysis The Skill installs `mlx-whisper` without pinning an audited version or verifying package hashes. Consequently, the actual package installed depends on the current state of the configured Python package index at installation time. The transcription model is also selected through the mutable repository identifier `mlx-community/whisper-large-v3-turbo`, without an immutable revision or integrity digest. Changes to the upstream package or model repository can therefore alter the code or model artifacts used after this Skill has been reviewed. This creates a supply-chain risk. If an upstream release, maintainer account, package index, or model repository is compromised, users following the documented workflow may retrieve a malicious or unexpectedly changed component. ### Attack Path 1. An attacker compromises the upstream Python package, its publisher account, the package distribution channel, or the referenced model repository. 2. The attacker publishes a mal ...[truncated 1047 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run_pipeline.sh:69
Finding: Output Path Traversal Through an Unvalidated Slug
Content: View full analysis
/dev/null 2>&1; then echo "[error] Required command not found: $cmd" >&2 if [[ "$cmd" == "ffmpeg" ]]; then echo "[hint] Install with: brew install ffmpeg" >&2 elif [[ "$cmd" == "mlx_whisper" ]]; then echo "[hint] Install with: pip install mlx-whisper" >&2 fi exit 127 fi done echo "[info] Video URL: $VIDEO_URL" >&2 echo "[info] Slug: $SLUG" >&2 # Set up output directory OUT_DIR="$OUTPUT_BASE/gettr-transcribe/$SLUG" mkdir -p "$OUT_DIR" AUDIO_FILE="$OUT_DIR/audio.wav" VTT_FILE="$OUT_DIR/audio.vtt" ``` The downloader later enables unconditional output replacement: ```bash if ! ffmpeg -hide_banner -loglevel warning -y -i "$IN_URL" \ -vn \ -ac 1 \ -ar 16000 \ -acodec pcm_s16le \ "$OUT_FILE" 2>&1; then ``` ### Technical Analysis The caller-controlled `SLUG` value is directly concatenated into `OUT_DIR` without validation or canonicalization. Although shell quoting prevents shell metacharacters from becoming command injection, it does not prevent filesystem traversal components such as `../`. A slug containing traversal segments can resolve outside `"$OUTPUT_BASE/gettr-transcribe"`. The script then creates that directory and writes fixed filenames named `audio.wav` and `audio.vtt`. Because `ffmpeg` is invoked with `-y`, an existing `audio.wav` at the resolved destination may be overwritten without confirmation. The optional caller-controlled `OUTPUT_BASE` also permits arbitrary output placement by design, but traversal in `SLUG` violates the documented output-directory boundary even when the default base is used. ### Attack Path 1. An attacker persuades the caller or controlling a ...[truncated 1106 chars]
Remediation: View remediation
&2 exit 2 fi ``` 2. Explicitly reject empty values, path separators, `.` components, and `..` components. 3. Canonicalize both the output root and resulting destination, then verify that the destination remains beneath the canonical output root. 4. Consider deriving the slug internally from a validated GETTR URL rather than accepting an independent caller-provided path component. 5. Avoid unconditional overwrite where possible. Refuse to replace existing files unless an explicit overwrite option is provided. 6. Document that the pipeline should not be run with elevated privileges. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/download_audio.sh:9
Finding: Unrestricted Media Input Permits Non-GETTR Local and Network Resource Access
Content: View full analysis
/dev/null 2>&1; then echo "ffmpeg not found. Install with: brew install ffmpeg" >&2 exit 127 fi mkdir -p "$(dirname "$OUT_FILE")" # Extract audio directly: 16kHz mono WAV (optimal for Whisper) # -vn: no video # -ac 1: mono # -ar 16000: 16kHz sample rate # -acodec pcm_s16le: 16-bit PCM (standard WAV) # -hide_banner -loglevel warning: cleaner output if ! ffmpeg -hide_banner -loglevel warning -y -i "$IN_URL" \ -vn \ -ac 1 \ -ar 16000 \ -acodec pcm_s16le \ "$OUT_FILE" 2>&1; then ``` The pipeline passes the value through without validation: ```bash VIDEO_URL="$1" ``` ```bash "$SCRIPT_DIR/download_audio.sh" "$VIDEO_URL" "$AUDIO_FILE" >&2 || { echo "[error] Failed to download audio" >&2 exit 1 } ``` ### Technical Analysis The Skill is documented as downloading media from GETTR, but the executable scripts do not validate the input scheme, hostname, or resource type. Any value accepted by the installed `ffmpeg` build is passed to its input handler. Depending on enabled ffmpeg protocols and demuxers, the argument may reference arbitrary remote hosts, internal network services, or local files rather than an approved GETTR media endpoint. This creates a server-side request forgery-style primitive when an untrusted party can influence the argument supplied by an agent or automation system. It can also cause local files to be opened and processed if they are valid media. Quoting `"$IN_URL"` prevents shell command injection, but it does not restrict which resource ffmpeg accesses. ### Attack Path 1. An attacker supplies a crafted media argument instead of a legitimate GETTR media URL. 2. The controlling agent or user passes that value to `run_ ...[truncated 1012 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose describes a broader workflow: taking a GETTR URL, downloading audio from the post or stream, and transcribing it locally with MLX Whisper including timestamps/VTT output. The provided code chunk is only a narrow helper that extracts audio from an already-supplied media URL using ffmpeg and writes a WAV file. That audio extraction step is related, but the primary declared behavior—transcription and timestamp generation—is absent. Additionally, the script is not GETTR-specific; it expects a direct m3u8 or mp4 URL, not a GETTR page/post URL parser or downloader. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.